There are critical vulnerabilities in HP’s Universal Print Driver Series (PCL 6 and PostScript) that could allow attackers to inject and execute malicious code, according to a security advisory from HP. Updates have been released and should be installed immediately.
The issues are due to the third-party components used in the driver. The various vulnerabilities are labeled as both critical and high risk:
- CVE-2017-12652 (Arbitrary Code Execution)
- CVE-2022-2068 (Arbitrary Code Execution)
- CVE-2023-45853 (Information Disclosure)
- CVE-2020-14152 (Denial of Service)
HP’s Universal Print Drivers support thousands of different printer models and are therefore in widespread use. You can independently check whether your own printer is affected with this list from HP.
Update your HP printer drivers ASAP
All versions prior to the current version (7.3.0.25919) are affected by these critical security vulnerabilities and should be updated. The updated drivers are available in different versions on HP’s download page.
Old printer entries in the system should be manually removed after installation, as these aren’t deleted automatically. To ensure that only the latest drivers are used after installation, administrators should double-check and remove old entries themselves.
Further reading: HP printers apparently have AI now